Modernizing perimeter security: Scalable perimeters with VPC Service Controls
Google Cloud enhances VPC Service Controls to simplify and scale perimeter security for autonomous agents and multi-project environments, improving data protection without added cost.
Agents operating at machine speed require secure-by-default guardrails distinct from traditional network perimeters. Google Cloud’s VPC Service Controls now allow administrators to include folders in perimeter membership, automatically extending policies to all nested projects and subfolders. This simplifies lifecycle maintenance and ensures new workloads inherit protection by default, aligning security with existing resource hierarchies. Dry-run mode supports folder membership, enabling administrators to evaluate perimeter effects on live traffic before enforcement.
Granular ingress and egress rules now support Google Cloud folders and organizations, replacing lengthy project lists with concise hierarchy references. Private Service Connect endpoints for Google APIs can be specified in rules, aligning policies directly with connectivity architecture. Service patterns in VPC accessible services enable administrators to restrict access to validated API URL patterns over private paths, reducing the need for broad allowances while maintaining operational flexibility.
VPC-SC Violation Analyzer introduces Guided Violation Remediation to resolve blocked requests faster, cutting resolution time from days to minutes. The tool evaluates denials against perimeter configurations and proposes narrowly scoped policy fixes, such as adding ingress rules or updating access levels. Administrators can validate recommendations in Dry-Run mode before applying changes, avoiding the need to broadly open perimeters to restore access.
VPC Service Controls now supports managing perimeters across complex multi-project environments with minimal manual intervention. Administrators can establish folder baselines, observe traffic safely in Dry-Run mode, and use automated remediation to unblock applications. The enhancements ensure data remains protected by default while accommodating legitimate operational requirements through private paths and granular controls.